1681585 - Update ECH implementation to draft-09

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Kevin Jacobs [:kjacobs]]

NSS 3.60 contains an implementation of the latest ECH draft (draft-ietf-tls-esni-08). This bug tracks the next update to -09.

Comment 1

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1681585 - Update ECH to Draft-09.

Depends on D99277

Comment 2

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1681585 - Add ECH support to selfserv.

Usage example:
mkdir dbdir && cd dbdir
certutil -N -d .
certutil -S -s "CN=ech-public.com" -n ech-public.com -x -t "C,C,C" -m 1234 -d .
certutil -S -s "CN=ech-private-backend.com" -n ech-private-backend.com -x -t "C,C,C" -m 2345 -d .
../dist/Debug/bin/selfserv -a ech-public.com -a ech-private-backend.com -n ech-public.com -n ech-private-backend.com -p 8443 -d dbdir/ -X ech-public.com
(Copy echconfig from selfserv output and paste into the below command)
../dist/Debug/bin/tstclnt -D -p 8443 -v -A tests/ssl/sslreq.dat -h ech-private-backend.com -o -N <echconfig> -v

Depends on D101049

Comment 3

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/ed07a2e2a124fd3542fa4467de1da35c7e7f53de
https://hg.mozilla.org/projects/nss/rev/92dcda94c1d4688edad2c094d505cd253757c0d4

Planning a minor API tweak under a separate bug.